Cross-Site Request Forgery in Add Polylang support for Customizer by WordPress
CVE-2026-22462

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Add Polylang Support For Customizer
Vendor
CVE Published:
22 January 2026

What is CVE-2026-22462?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Add Polylang support for Customizer plugin for WordPress. This vulnerability enables attackers to induce users to perform unwanted actions on their behalf while interacting with the application. Users on versions from n/a up to 1.4.5 are at risk when the plugin is active, as unauthorized requests can exploit this flaw, potentially compromising the integrity of user actions and leading to unauthorized changes.

Affected Version(s)

Add Polylang support for Customizer 0 <= 1.4.5

References

https://patchstack.com/database/Wordpress/Plugin/add-poly...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan | Patchstack Bug Bounty Program
.